topic Re: Extract Indicators from context to Field in Cortex XSOAR Discussions

Extract Indicators from context to Field

MTubia — Thu, 01 Dec 2022 09:12:30 GMT

Hi,

I have one playbook where I'm using the Builtin ExtractIndicators Function to extract any indicator from one field, and it's working fine:

After this, I call more subplaybooks, and I want, from this subplaybooks, use this indicators for some action, for example send an email or create a ticket in a ticketing system.

How can I access to this indicators? Is there any way to "copy" all the indicators in one time?

Anyway, I'm trying to access to this indicators from a subplaybook, one-by-one, like:

${ExtractedIndicators.[0].Domain.[0]}

This is not working, I get an empty result.

So, I have two questions:

Can I access from one subplaybook to data from a "upper" playbook?
Can I get all the indicators with one command or must I put them one by one?

Thanks!

Re: Extract Indicators from context to Field

Josep — Thu, 01 Dec 2022 10:21:04 GMT

Hello,

Can I access from one subplaybook to data from a "upper" playbook?
Can I get all the indicators with one command or must I put them one by one?

You can create an input in the subplaybook, with no need to be mandatory, and just introduce the variables you need.

Re: Extract Indicators from context to Field

Josep — Thu, 01 Dec 2022 10:24:20 GMT

Example inside the "Playbook Triggered" at the subplaybook, in this case is mandatory the input:

Re: Extract Indicators from context to Field

MTubia — Thu, 01 Dec 2022 11:14:06 GMT

Thank you for your help!!